Classifying a grounded prompt by sensitivity and provenance, and routing it down the execution path that classification earns — immediate execution, logged auto-approval, human review, or block. Includes defending the grounding pipeline itself against being used as the vector for a goal-hijack or exfiltration attempt, distinct from prompt-content moderation.